us-bridge-trezir[.]pages[.]dev

The domain us-bridge-trezir.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. It posed as a legitimate 'Trezor Bridge' service to deceive users into exposing sensitive information or credentials, aligning with cryptocurrency-related scams. As of the latest verification, us-bridge-trezir.pages.dev has been taken offline, though its prior activity remains a documented threat.

Technical analysis of us-bridge-trezir.pages.dev reveals limited but notable detection. The domain was flagged by 2 of 95 security vendors on VirusTotal, including LevelBlue and Phishing Database, while appearing on 1 security blocklist (PhishDestroy). Registered through Cloudflare, Inc. on September 26, 2025, it resolved to the IP address 188.114.97.3, hosted by Cloudflare in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Trezor Bridge — The Secure Gateway to Your Hardware Wallet®'. Technologies detected included HSTS, Cloudflare, and HTTP/3. Google Safe Browsing did not flag the domain, and Gridinsoft assigned a trust score of 0/100.

Users who interacted with us-bridge-trezir.pages.dev should immediately revoke any token approvals or wallet connections made during the encounter. Transfer cryptocurrency funds to a new, secure wallet and monitor accounts for unauthorized transactions. Change passwords for any accounts accessed via the phishing site and enable multi-factor authentication where available. Report the domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand (Trezor) to aid in broader mitigation efforts.